thunderbird-extension
Warn
Audited by Snyk on Jun 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.85). The required runtime workflow includes message display scripts/content extraction that send
document.body.innerText(i.e., the displayed email/message text, authored by an outsider) into the extension’s background viamessenger.runtime.sendMessage({ content: document.body.innerText }), which then becomes LLM-readable context if the agent uses that message content.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata